The website automatically logins to my account without entering mail address and password. How does this work even though after restarting router, clearing cache & cookies of browser?
The email links definitely contain tokens - not only will they log you in but the articles they generate on the page will reflect the order of articles in the email you received, as opposed to the most recent articles on your feed.
You can exploit the fact that HTTP caching sends the ETag back and forth. A server can set a crafted ETag and basically use it as a session ID. See [1][2]
Don't know, I do however have a problem with Quora that is probably related to whatever way they achieve their auto login. I have an Quora account, but at some point in time I accidentally clicked register instead of login, and now I'm permanently stuck in the registration process. Can't login, and the registration is impossible to complete, at least the last time I tried.
Yeah and I tried to clear everything I could, but no dice.
9 comments
[ 3.2 ms ] story [ 32.0 ms ] threadThey could potentially be using something based on this, https://panopticlick.eff.org
https://en.wikipedia.org/wiki/HTTP_ETag
[1] http://security.stackexchange.com/questions/12679/how-can-i-... [2] https://github.com/lucb1e/cookielesscookies/blob/master/inde...
Yeah and I tried to clear everything I could, but no dice.